foobar2000_get_interface
Static task
static1
Behavioral task
behavioral1
Sample
271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549.dll
Resource
win10v2004-20240226-en
General
-
Target
271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549
-
Size
1.2MB
-
MD5
0b139c9d132bc5b583f4a99142324358
-
SHA1
2284fae7a6f2e6f88bec041c71ffecb78c3be63f
-
SHA256
271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549
-
SHA512
04b3907074834115495219f061bfcef6d15804b38aaa191a8d7ebe119d4461a193819ba3c8f4c8a7a6d5a1aa93f7922f902b84bde9f6d77cbbfcc4cf808cad56
-
SSDEEP
24576:ylWFb/98uEFQAMzXg53iBNaOv3QgdEfH:ylWFb/98qAMM3iBNaOv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549
Files
-
271d223eb0c0e92b19b395a1ece12e1a4608e91f3728a04002ed74ee82836549.dll windows:6 windows x64 arch:x64
64e92913ed552db20fdab1539dfbb53c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
zlib1
zError
deflateInit2_
deflateBound
deflateEnd
deflate
shared
stricmp_utf8_ex
uPrintfV
uPrintCrashInfo_OnEvent
uBrowseForFolder
uSetDlgItemText
uGetDlgItemText
uSendDlgItemMessageText
GetInfiniteWaitEvent
uBugCheck
shlwapi
StrCmpLogicalW
kernel32
DisableThreadLibraryCalls
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetLocaleInfoEx
IsDebuggerPresent
GetThreadPriority
SetThreadPriority
CloseHandle
SetEvent
CreateEventA
LocalFree
FormatMessageA
FormatMessageW
WideCharToMultiByte
DuplicateHandle
ReleaseSemaphore
WaitForSingleObjectEx
GetCurrentProcess
CreateSemaphoreA
Sleep
GetProcessHeap
HeapAlloc
HeapFree
VerSetConditionMask
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
VerifyVersionInfoW
CancelIoEx
GetFileSizeEx
ReadFile
MultiByteToWideChar
CreateFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFilePointerEx
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
GetCurrentProcessId
GetCurrentThreadId
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
GetCurrentThread
user32
SetWindowLongPtrW
GetWindowLongPtrW
EnableWindow
SendDlgItemMessageW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
CreateDialogParamW
DestroyWindow
DefWindowProcW
msvcp140
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Thrd_hardware_concurrency
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_broadcast
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Thrd_id
_Thrd_join
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Strxfrm
_Strcoll
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?precision@ios_base@std@@QEAA_J_J@Z
?unsetf@ios_base@std@@QEAAXH@Z
?exceptions@ios_base@std@@QEAAXH@Z
??Bios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?classic@locale@std@@SAAEBV12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
ws2_32
WSAAddressToStringW
ntohl
htons
htonl
WSASocketW
listen
bind
WSASend
WSARecv
WSAGetLastError
WSASetLastError
shutdown
setsockopt
ioctlsocket
closesocket
WSACleanup
WSAStartup
ntohs
mswsock
GetAcceptExSockaddrs
AcceptEx
TransmitFile
vcruntime140
strchr
__C_specific_handler
__RTDynamicCast
__std_type_info_name
__RTtypeid
__current_exception
memchr
memcmp
__std_type_info_compare
memset
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
__current_exception_context
__std_type_info_destroy_list
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_initialize_onexit_table
_beginthreadex
_errno
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
_crt_atexit
_cexit
strerror
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_execute_onexit_table
api-ms-win-crt-string-l1-1-0
isspace
ispunct
strncpy
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
calloc
realloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsscanf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
copysign
_dclass
_dsign
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
api-ms-win-crt-environment-l1-1-0
_wgetenv
api-ms-win-crt-utility-l1-1-0
srand
rand
Exports
Exports
Sections
.text Size: 846KB - Virtual size: 846KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 263KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 77KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ